The Ashimmy Blog

Security Blogger Award Winners 2013

Well it was an epic Security Blogger Meetup and awards this year. In many ways it was the best one we have had. But nothing is perfect and we are already planning to be bigger, better and more inclusive next year.  In the meantime I know many folks have been waiting to see who the winners of the Social Security Blogger Awards were.  So without further adieu, for the record here are the nominees and winners:

Best Corporate Security Blog

Other nominees:

McAfee Blog: click here

CloudFlare Blog: click here

SecureWorks Blog: click here

Solutionary Minds Blog: click here

Kaspersky Lab Securelist Blog: click here

Veracode Blog: click here

Trend Micro Blog: click here

AND THE WINNER IS:

Naked Security Blog: click here

Best Security Podcast

Other nominees:

Liquidmatrix Security Digest: click here

EuroTrashSecurity: click here

SANS Internet Storm Center: click here

Southern Fried Security: click here

Risky Business: click here

Sophos Security Chet Chat: click here

And the winner is:

Paul Dotcom: click here

The Most Educational Security Blog

Other nominees:

BH Consulting's Security Watch Blog: click here

Security Uncorked Blog: click here

Dr. Kees Leune's Blog: click here

Securosis Blog: click here

Social-Engineer.org Blog: click here

Critical Watch Blog: click here

The Security Skeptic Blog: click here

The New School of Information Security Blog: click here

And the winner is:

Krebs On Security: click here

The Most Entertaining Security Blog

Other nominees:

Packet Pushers Blog: click here

Securosis Blog: click here

Errata Security Blog: click here

Naked Security Blog: click here

Uncommon Sense Security Blog: click here

PSilvas Blog: click here

And the winner is:

J4VV4D's Blog: click here

The Blog That Best Represents The Security Industry

Other nominees:

SpiderLabs Anterior Blog: click here

1 Raindrop Blog: click here

Naked Security Blog: click here

The Firewall (Forbes) Blog: click here

Threat Level (Wired) Blog: click here

Securosis Blog: click here

Michael Peters Blog: click here

And the winner is:

Krebs On Security Blog: click here

The Single Best Blog Post or Podcast Of The Year

Other nominees:

The Epic Hacking of Mat Honan and Our Identity Challenge: click here

Application Security Debt and Application Interest Rates: click here

Why XSS is serious business (and why Tesco needs to pay attention): click here

Levelling up in the real world: click here

Secure Business Growth, Corporate Responsibility with Ben Tomhave: click here

And the winner is:

Meet The Hackers Who Sell Spies The Tools To Crack Your PC (And Get Paid Six-Figure Fees): click here

The Security Bloggers Hall Of Fame

The other nominees are:

Richard Bejtlich

Gunnar Peterson

Naked Security Blog

Wendy Nather

And the winner is:

Jack Daniel

Congratulations to all of the nominees and of course congrats to the winners.  See you next year at the Security Bloggers Meetup. If you did not get an invite this year, be sure to write to info@securitybloggersnetwork.com requesting to add your blog and be on the list!

Special thanks to our sponsors: Qualys, Sourcefire, Akamai, Fortinet, Barracuda Networks and Jeanne Friedman and the RSA Conference!  Also a special shout out to Trainer Communications for helping with the voting as always!

Sunguard Availability Services at RSA 2013

RSA Conference is THE information security event of the year. Kicking off my coverage of RSA this year is a series of podcasts I did with cloud/hosting providers who are exhibiting this year in the partner pavilion of Alert Logic.  

My friends at Alert Logic have 5 of the largest hosting/cloud providers in the world exhibiting with them. I was curious why these cloud and hosting providers wanted to exhibit at a security conference.

The first provider I spoke with was Sunguard. Specicifally Sunguard Availability Services. I spoke with Cara Camping, Product Manager, Managed Security Services for Sunguard AS. Cara talks about Sunguard's approach to security in depth, why they partner with Alert Logic and what they expect from exhibiting at RSA Conference.

Below are two slides that Cara references in our discussion:

 

Related articles

RSA Conference 2013, YOU READY!?

Where is AShimmy at RSA?

Security Blogger Awards Finalist Voting Is Now Open!

Security Blogger Awards Finalist Voting Is Now Open!

Well finally I am happy to report that the finalists have been selected and voting for the 5th annual Social Security Blogger Awards is now open!. I know many of you did not understand and were confused by the preliminary rounds of voting. However, our new method of picking finalists has resulted in what we think is our strongest group of finalists ever.

We have many of the blogs and podcasts that have been nominated before (quality is quality), but we also have many new or never before nominated sites as well.  Many thanks to our all star panel of judges who nominated some of the finalists – Bill Brenner of CSO, Kelly Jackson-Higgins of Dark Reading, Wendy Nather of The 451 Group and none other than Beaker himself, Chris Hoff.

Also many thanks to all of the blogs and podcasts who requested to be nominated. Whether you made the finals or not, keep blogging.

You can go vote for your picks here. As in years past, to vote in the finals you have to be a security blogger or podcaster yourself.  All votes are reviewed by humans, so please just vote once and don’t try to game the system.

Special thanks to Trainer Communications for all of the help with voting and helping. Also special thanks to sponsors of the Bloggers Meetup – Qualys, Fortinet, Sourcefire, Akamai, Barracuda Networks and RSA Conference.

Here are the finalists.  Good luck to them all!  Of course winners will be announced at the Bloggers Meet up at RSA Conference 2013.

Best Corporate Security Blog

McAfee Blog: click here

CloudFlare Blog: click here

SecureWorks Blog: click here

Solutionary Minds Blog: click here

Kaspersky Lab Securelist Blog: click here

Veracode Blog: click here

Trend Micro Blog: click here

Naked Security Blog: click here

Best Security Podcast

Liquidmatrix Security Digest: click here

EuroTrashSecurity: click here

Paul Dotcom: click here

SANS Internet Storm Center: click here

Southern Fried Security: click here

Risky Business: click here

Sophos Security Chet Chat: click here

The Most Educational Security Blog

BH Consulting's Security Watch Blog: click here

Security Uncorked Blog: click here

Dr. Kees Leune's Blog: click here

Securosis Blog: click here

Social-Engineer.org Blog: click here

Critical Watch Blog: click here

The Security Skeptic Blog: click here

Krebs On Security: click here

The New School of Information Security Blog: click here

The Most Entertaining Security Blog

Packet Pushers Blog: click here

J4VV4D's Blog: click here

Securosis Blog: click here

Errata Security Blog: click here

Naked Security Blog: click here

Uncommon Sense Security Blog: click here

PSilvas Blog: click here

The Blog That Best Represents The Security Industry

SpiderLabs Anterior Blog: click here

Krebs On Security Blog: click here

1 Raindrop Blog: click here

Naked Security Blog: click here

The Firewall (Forbes) Blog: click here

Threat Level (Wired) Blog: click here

Securosis Blog: click here

Michael Peters Blog: click here

The Single Best Blog Post or Podcast Of The Year

The Epic Hacking of Mat Honan and Our Identity Challenge: click here

Application Security Debt and Application Interest Rates: click here

Why XSS is serious business (and why Tesco needs to pay attention): click here

Meet The Hackers Who Sell Spies The Tools To Crack Your PC (And Get Paid Six-Figure Fees): click here

Levelling up in the real world: click here

Secure Business Growth, Corporate Responsibility with Ben Tomhave: click here

The Security Bloggers Hall Of Fame

Jack Daniel

Richard Bejtlich

Gunnar Peterson

Naked Security Blog

Wendy Nather

Related articles

• And The Nominees Are . . . (365.rsaconference.com)
• Social Security Blogger Awards 2013 Judges Announced (ashimmy.com)

Security Blogger Awards 2013 News

Well we are one week from Thanksgiving and RSA has notified those who will be presenting this year.  That means the voting for the Social Security Blogger Awards cannot be far off.

As promised this year we are going to do things a little differently. First of all we are adding some new judges. I think you will find them beyond reproach as some of the best in our community.  Secondly, we are going to let you nominate some of the finalists!

In order to do this we are going to set up a nomination process where sites trying to be nominated by popular vote can put a “vote for me” badge on their web site.  The top vote getters in nominations along with the judges picks will be the finalists that will then be voted for by all bloggers.

If you are interested in the vote for me option for your blog or podcast, please write to info@securitybloggersnetwork.com.

The categories for this year are:

Best Corporate Security Blog

Best Security Podcast

The Most Educational Security Blog

The Most Entertaining Security Blog

The Blog That Best Represents The Security Industry

The Single Best Blog Post or Podcast Of The Year

The Security Bloggers Hall Of Fame

Stay tuned for more news soon!

Related articles

• Security Blogger Awards 2013 (ashimmy.com)
• Top 20 Security Blogs (veracode.com)

Security Blogger Awards 2013

Well it getting to that time of year.  The organizing committee is already hard at work planning the Security Bloggers Meet up for 2013 at RSA Conference. Once again we will also have the Security Blogger Awards.  Based on the feedback from last year, we are going to try to do things a little different this year. 

First of all I am going to ask some of the most prominent bloggers in the community to help nominate the finalists this year. Of course this means there blogs will be ineligible for awards.  Also I am going to ask you, the blogger community to nominate blogs and podcasts.  We will have some sort of open vote to get to finalists.  It will result in a finalist list made up of nominated blogs by judges and those nominated and voted by readers.  Once finalists are selected, voting will be open only to fellow bloggers though.

In terms of categories, I am thinking pretty much the same as last year. We may add one or two more though if you have a good suggestion.

We hope that this addresses some of the suggestions we had last year. If you have any input or other suggestions, now would be a good time to put them in.  Email us at info@securitybloggersnetwork.com

In the meantime the clock is ticking. RSA Conference 2013 will be here before you know it!

Spam Cop: If The Messenger Has The Message Wrong, Shoot Him

So it seems that my post both here and on Network World about my recent experience with Spam Cop has touched some nerves in the anti-spam community. I understand, no one likes to hear that their baby is ugly or even worse a bully.  But I will stand by my initial posts.

My friend Richi Jennings is one of the people saying I am wrong on Spam Cop and he has written a very nice retort here.  I read it and we have gone back and forth on some comments, but I think it best I respond here.

First of all Richi and some others have the fact pattern wrong. I was not running a mail list server for a youth sports league. I was sending an email from my own email account to a fellow board member of a youth sports league I am involved with. The message that was blocked was from my own email account. So the whole “mail list management thing” is a red herring here.

Richi says that is even more reason to move my email account. As I wrote previously this is an email account which is kept at GoDaddy along with my domain and web site. It is a shared mail server I am sure (as opposed to someone who commented on Network World that this is what happens when people who shouldn’t administer their own mail servers do so). Moving my domain, web site, database, etc. is going to be a lot of work. I know GoDaddy is not perfect. But again I think Richi and the rest miss the real points of my post because they are so busy defending the stop spam industry.

Secondly I am familiar enough with reputation based filtering and the technology involved. I am not some Internet newbie you have to spoon feed. I owned a hosting company that battled spammers way back in 1995 and have been involved in hosting and the security industry since, so this is not my first ride on the spam tuna boat.

So here are the two main points I was making:

1. Spam Cop should not hide behind the skirts of the blocking ISPs. Don’t tell me that Spam Cop is not responsible for blocking my email, it is the ISP that is doing it. That is akin to me giving you a gun, telling you to shoot someone and then saying, “I didn’t shoot him”. You are still guilty. Stand up and say “we told the ISP that the host you are using has sent spam recently and they blocked your email as a result”. That is the truth and doesn’t make it sound like you are hiding behind someone else for your actions.

2. When you actually put things in writing like “They no longer have any sympathy for the innocent bystanders, such as yourself, who are using a mail server which has found its way onto one of the several major blocking lists.” You are asking for trouble.  It is just plain wrong. It violates long standing principles of law and common sense.  Let me give you an analogy and see if it helps.

Lets say we lived in an apartment building in a large city.  I was there with my wife and sick child who is on an electric respirator.  It was a large apartment building with 150 or more tenants. One of those tenants (but not me) had rigged his electric meter and was stealing power from the local electric utility.  There was a service that monitored electric usage and notified the utility that someone in that building was stealing electricity. Based upon that, the electric utility shut off electricity to the building. As a result my baby’s respirator didn’t work. Do you think the electric utility and even the electricity monitoring company should be liable at least civilly if not criminally for what happened here? Or are you going to tell me the thief stealing the electricity is responsible for my baby' not having his respirator?  I can tell you that I hope that electric company and the monitoring company have very deep pockets and lots of insurance because they are in a heap of trouble.

Our system of justice and law is based on the principle that the innocent are not punished for the crimes of the guilty. In fact there is a legal theory that better 10 guilty men go free than one innocent is punished.

There is also a long standing principle of due process. When I write and say that my email has not been used for spam and you have blocked me wrongfully, I should be entitled to due process and a chance to prove my case instead of just being told tough, even if you are innocent.

This is exactly what you are doing by freely saying we don’t care that innocent bystanders get hurt along the way. That is the same argument used in the theory of “total war” in WW II to justify bombing civilian centers such as London. It wasn’t right then and it certainly isn’t right to use to combat spam.

For the average company (and there are millions of them) that host their web site, data base, web applications and email at large providers like GoDaddy, picking up and moving all of that is no easy task and involves a big expense. Instead of saying the hell with the innocent, how about perfecting the technology so the innocent aren’t the ones being harmed.

The real spammers hop from server to server and when one gets blocked they move on to the next, it is the innocent who get left holding the bag. When your mission becomes so obsessive that you lose sight of protecting the innocent, it is time to step back and reevaluate.

How Come My Blog/Podcast Wasn’t Nominated?

With last weeks announcement of the finalists for this years Social Security Bloggers Awards there has been the usual buzz about the awards, the Security Bloggers Network and the bloggers meet up.  I want to say from the outset that in total all of the blogs/podcasts nominated as finalists belong there.

Of course there are so many blogs and podcasts that inevitably some worthy ones don’t make the list. This year there has been some questioning of how we pick the finalists and questioning of why certain blog/podcasts were left out. I should say that it seems mostly centered in the podcast category.

As a result I have made a write in option available for qualified voters(more on that in a second) to write in their own selection for best podcast. So far I have a received a handful of write in votes.  That being said though, I wanted to go over how we pick the finalists and what the Social Security Bloggers Awards are all about.

First of all you should know that this year at RSA Conference we will be hosting the 6th annual Security Bloggers Meet up.  You can find out more about it at the RSA Conference blog for Bloggers Meet up, the Bloggers Meet up Facebook page and the Security Bloggers Network.

This is also the 4th year for the Social Security Bloggers Awards. Again you can read more about them on the links above. The idea behind the blogger awards was to recognize some of the leading bloggers in the security arena.  When I first came up with the idea I didn’t think people would get that excited about it.

In the first year of the awards we had judges nominate their choices for finalists (as we have every year since), then we let anyone who registered vote. Well it turned out like so many awards run by other organizations, nothing more than a popularity contest with some people trying to stuff the ballot box.  That was not the spirit that I envisioned with these awards.

The awards really grew out of the Security Bloggers Network which I started 6 or more years ago. While a blog or podcast does not have to be in the SBN to be considered or win an award, it was in that same sense of fostering a community among the security blogging space. 

So going forward I changed the voting for the awards. While our all star panel of judges still picked the finalists, voting was only open to security bloggers.  Each voter had to give their blog or podcast URL with their vote for us to verify. In this way it was an award “by the bloggers, for the bloggers”.  This of course drastically cut down the amount of votes cast, but made it a peer based award similar to the Screen Actor Guild SAG awards.  I thought that was pretty cool.

Each year I try to bring some fresh blood into the judges pool to get new views on what the best blogs and podcasts are.  I also refine and add new categories to hopefully better represent the market. But no matter what is done, there are always going to be some people who feel left out.

So for next year I am already thinking of how we can do this differently. I am open to suggestions. But I will reserve the right on behalf of myself and the bloggers meet up organizing committee to choose what we think is the best method. I want to keep the awards free from ballot box stuffing.

In the meantime I want you all to know that I and many others appreciate all of the great content that the security industry turns out in blogs and podcasts. Thanks to all of you for creating and consuming it. Being nominated or even winning an award is not the payback for why we do this, it is educating and joining in the conversation that keeps us doing it.  So please keep blogging and podcasting!

Social Security Blogger Awards 2012

Cooperstown, Canton, Springfield, Cleveland, what do all of these places have in common? They all are homes to a Hall of Fame. Now the Security Bloggers Awards will be joining them with Security Bloggers Hall of Fame too! 

It is Christmas time, so you know RSA Conference is not far away. If RSA is almost here, you know that is almost time for the annual Security Bloggers Meet up and Social Security Bloggers Awards. 

All of the plans have been made, the judges selected and the finalists will be announced after New Years.  As in years past all security bloggers are eligible to vote. But you will have to give your name, email and blog address.

Last years categories will return this year:

Best Corporate Security Blog

Best Security podcast

Most educational security blog

Most entertaining security blog

Security Blog that best represents the industry

The single best security blog post of the year

Additionally this year we will elect the first two members of the Security Bloggers Hall of Fame!

I will announce our judges and other information between Christmas and New Years.  This year all blogs are eligible except mine and the judges. Also be on the lookout for save the dates going out soon if you are on our list. If you are not on the list, send an email to info@securitybloggersnetwork.com or leave a comment requesting an invite. You must blog on security and no marketing/PR stuff please!

Related articles

• Blogging is a Conversation (ashimmy.com)
• New for RSA Conference 2012 - the Author's Studio (365.rsaconference.com)
• Securosis: Words matter: You stop attacks, not breaches (boxofmeat.net)
• Friday Summary, December 9, 2011 (securosis.com)

The Sleazy Dark Side of Product Reviews

Yesterday I wrote in response to Bill Brenner’s Salted Hash post about the Google-funded, Accuvant conducted browser security study which found (surprise) Chrome on top.

In my post yesterday I mentioned that one company that I thought is doing product  reviews right was NSS Labs.  Well Rick Moy of NSS Labs wrote me last night, having read my post.  The NSS Labs folks have had a look at what was publicly available.

Vik Phatak, CTO of NSS Labs has a blog post up on the subject here. More importantly Vik and team have put out a more complete analysis of problems they see with the way this study was conducted and some issues in Google’s behavior. You can read the analysis here.

It is a very interesting read and you should take a look for sure.  It certainly raises some questions about what went on with this browser study and calls into question some very questionable practices by Google. 

It just proves that product reviews are a dirty business and why any reader has to look at and weigh all factors in deciding how much faith to put in them.

Related articles

• The Death of Product Reviews (ashimmy.com)
• What's the Most Secure Web Browser? [Security] (lifehacker.com)
• Chrome sandboxing makes it the most secure browser, vendor study claims (arstechnica.com)
• NSS Labs claims its new tool can detect all Duqu drivers (infoworld.com)
• NSS Labs Claims Its New Tool Can Detect All Duqu Drivers (pcworld.com)

Blogging is a Conversation

For those of you who may be wondering, yes there will be a killer Security Bloggers Meet up at RSA this year. There will also be another Social Security Blogger Awards with some new categories as well. More on those in another blog. But the reason I write today is something Rich Mogull said on our blogger meet up organizing committee call.

Rich said “lets face it, the security blogger’s community isn’t what it used to be”. While I don’t disagree with Rich, I went back and looked at some of the numbers and some of the security blogs. While Rich is right, we don’t see as many as blog posts from the community as we used to, I think we all agree that Twitter probably plays a significant role in that. In fact the Tripwire 25 most influential people in security list seems pretty skewed towards twittter users. But that being said, there are still plenty of security blog posts being posted. The SBN feed is still fresh with lots of new posts every day.

One thing I do see is many of the posts come from corporate security blogs rather than individuals. Many of the corporate blogs don’t develop the personality that a good personal blog does. More importantly what has changed is another thing Rich brought up. We don’t comment anymore. We don’t blog back anymore.

People are blogging and putting their 2 cents into the conversation, but no one is repsonding. Oh, maybe they respond on twitter, on but it doesn’t make it into the blog. Blogging has always been and will always be a two way street. A blog should be a multi-party conversation with the blogger putting forth his ideas and others responding. They can agree, disagree, or concur, but they put their thoughts into the conversation.

One of the great things about reading a hot blog post was following the thread of comments, that was where the real action took place. Whether it was a Rothman post on Security Incite/Securosis or Tom Pcatek on Matasano, a good threat with 50 comments kept you reading for more.

Now maybe Twitter is where blog comments have gone and some of the discussion. Can we have a plug in that captures the real time of twitter comments and discussions back to the original blog post? Doesn’t sound too hard.

How about writing a blog post in response to another blog post? That is part of carrying on the conversation as well. Need something good to blog about? Go look at what your community is writing and join in.

Adam Shostack over on Emergent Chaos has a post up about Threat Modeling as a result of a conversation he had with Wendy Nather, who has her own good blog post about “what your analyst wishes you knew” (and she is not talking about your psychoanalyst either).

I am going over to both of those blogs and adding my voice to the conversation. I already tweeted Wendy’s post, but I realize that is not enough. If we are going to keep the Security blogging community strong and vibrant we have to add our voice on blogs.

What about you? Are you ready to rejoin the conversation?  If so, head over to your favorite security blog and join in.  Or better yet, write a blog in response to someone else’s blog.  It starts with you and you and you.

Related articles

• Reasons to Blog: Guest Post! (lexisjen.wordpress.com)
• Email chaos: How to reach Adam Shostack (emergentchaos.com)